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(57) Abstract: A sufficient numt)er of data items are selected (112) for inclusion in a data set so as to discourage a transmission 
of the entire set over a limited bandv^tdth conununications path (130), such as the Internet Each data item comprises one or more 
sections, which taken together constitute the complete data set. Each section of the data set is linked to another section of the data sct« 
and each section* s link is bound to the section via the use of one or more watermarks. Upon presentation of material for rendering, 
the presence of the entirety of the data set is verified (126) by ascertaining the presence of linked-to sections. For further security, the 
links between sectioi^ is formed by a random selection of each linked-to section. To verify that each linked-to section corresponds 
to the original section that was linked-lo, each link contains an identifier of the linked-to section that can be used to determine that a 
retrieval of a linked-to section corresponds to the originally assigned linked-to section. If the identifier associauxl with the linked-to 
section does not property match the presented linked-to section, a rendering of the data items of the data set is prevented. In a 
preferred embodiment, a closed linked list is formed, so that every section of the data set can be included in the verification process. 
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, Protecting content fr^^ 



PACKGRQUNDO^^ . 

1. Field of the Invention 

^ i-ii ; -r-^.: : ™s invQ the field of consunfier electronics, and in 

p^i^ular to thp protection of copy-protected content material, 

2, Description of I^^^^ ^ , . . t 
: . ^ . . , illicit distributiori p^^ 

; .^i?PyR^/^ for tWs niateri illicitly 

disl^b)ited material \vith gains th^t enpovir^ge continued illicit distributions. In light of the 

v. 9^9^PV^^f?^^^^^^ ttan;sfer prpyided by tbe lptem^^^^ that is intended to be 

popy-protectefi, supb as ^istjc rendejijig? ipr^Aer tnaterial ^ying jimite rights, 
are susceptible , to vjdde^sp^ and toansmittijog 

: ^"^^^ files.has made the vv^de-scal^^stribution of audio, recqi-dings feasible, 

P'^i^^^^^^^i^® (^gital audio recording of'a song can be compressed into a 3. or 
, > l^^l^^y^^ ^ typical 56 kbp§ dial-up^ cprmecti^n to the Internet, this MPS 

. ^ x^y^^**?^^^ *I° a Mser's computer in a few piinutes. Thu3, a malicious party could 

read sonps from an origin^ apd legitimate CD, encode^the songs into MP3 fopnat, and place 
the MPS encoded song on the.Intemc|t for \yide-s^^ distribution, Alternatively, 

: .fhe pialicious payty could pi;oyide a dirgqt dial-in service for downloading the MPS encoded 
song. T|]|f;. illicit <^opy of the MP3 encoded song can be subsequently rendered by software or 

, hardware devices, or can be decom^^ stored onto a recordable CD for playback on a 

conyentionalLCD player. 

. u: I : ;^ "V'??'^'" P^sche|n^es. hayp be^ prqpKpsed for limiting t^e reproduction of 
4*??P^rP?^?i^*^^4;P9?l?'^^ Music Initiative (SDMI) and others, 

;M^S^^l5^f*?^;iMT^ ^?*?'?P^Klf9u'^?i®i^^l^^^ 098 1 90 1 

%h P^'fel'S^H l:K^^K?P99M'?9'9Ses^tephni9ue for 
.?^?^9'^?^^.''?^!^'3'^^?Pl9.'^^ '^vi!^'P?P!5r. watermark cp^imterp digital vyatermark 

: '55"™^*^^?*?;!'? 59.¥ tp be. detectable, but unobtrusive. An audio 

playback of a digital music recording containing a watermark, for example, will be 
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substantially indistinguishable from a playback of the same recording without the watermark. 
A watermark detection device, however, is able to distinguish these fw6 recordings based on 
the presence or absence of the watermark: Because some content material may not be copy- 
protected and hence may not contain a watermark, the absence of a watermark cannot be used 
5 to distinguish legitimate from illegitimate material. On the contrary, the absence of a 
watermark is indicative of content material that can be legitimately copied freely. 

Other copy protection schemes are also available. For exaniple, Eurbpean 
patent EP0906700, "Method and syslerri for transferring coriteht infbraiktidn 

' " " suppleriiental information related thereto published April 1^99 pi^esents a technique for 

1 0 the protection of copyright material Via the use of a watermark "ticket" that controls the 
number of times the protected material may be rendered. 

An accurate reproduction of watermarked material will cause the watermark to 
be reproducedi in the copy of th^e wateniiiarked material. Ah inaccurate, or lossy reproduction 
of watermarked material, hbwever, miy hbt prbvide a reproduction of the watertn^k in the 

1 5 lossy cb^y of the material. A liumbfer of pri&tectibh schemes, including thdse bfAe SDMI, 
have taken iadvantige of this ChMctenstic of lossy reproduction b distinig^^ 

- ' riiaterial from illegitimate material, b^ed on the ptesehce or Absence bf an appropriate 
V/atemiark. In the SDMI sce^lari6v^wo typfes bf wa^^^ are definedf 'SrdbtiM" * 

watetmarks, and "fragile" vvatermarks.' A robust watemark is one that is expecteS to survive 

20 alossy reprbductiori^^t^^^ a substantial portion of the oftgiiial cbntent 

niaterial, such as an MP3 ericoSihg bf Sn audiorecbrding. TTfiat is, if the reprddtiction retains 
sufficient ihforination^o allo^ a reSasoViabie rendering of the brigjnil recording; the robust 
' watermark will also be fe^^^ 
ekpected to bfe cormpte^^^ 

25 ' In the SDMI scheme,^^^^^^ 

content material is copy iirbfectedj'and the a^^^ 

watermark w^heri a robust watermark is present indicates that the copy protected liiiaterial has 
been tampered with in some manner. An SDMI compliant deVide is cohfiguted to refuse to 
reiider wateirtnafked material virith a'Cortiipted watermark, of with k detected robust 
30 ' " vvaterni^bu^ an afesent Mgilb Watermark, e>cc^pt if ihe cbrniptibn br^bsS^ 
' - ^ ^ WkemiMls^i^^^ of • 

^ • ^bSpyiifctec^ k^iMMe plSyerv For of Ifefereiice- 

' the terhi "render" i^ used^hererH'^b incTtide 'any ptbctiSsihg of tin^ of tKe content 

niaterial, such as playiiig;rec5rdm^^ validatihjg, storihjl, loading, anil the like. 



5 

minimize the likelihood of forgery, the entirety parameter is'baserd onaliash of a composite 
of section-specific identifiers. The referenced copending application also teaches the use of 
digitally signed certificates and other techniques that rely on cryptographic techniques, such 
as hashing and the like. - 
f . ,. ^"f S'^o^'^^nce with the invention herein, a self-referential data sdt is used that 

facilitates the determination of whether the entirety of the data set^s present, without the use 
of out of band data and without the use of cryptographic foncti^ such as a hash fiinction If 
the entirety ol the data set is not present, subsequent processing of the data items of the data 
, ^^*„',^ *5 context of digital audio recordings, a compliant playback or 

} ? i^^J^^^^ ^^^'^5 configured to refuse to render an individual song in the absence of the 
, , contents of the CD. The time required to download an entire album on a CD in 

uncompressed digital form, even at DSL and cable modem speeds, can be expected to be 
F^^lff ^han an hour, depending upon network loading and other factors, thus, by requiring 
;v - - the CD be present in uncompressed form^ at a download\ost" of 

1 5 over an hour, the likelihood of a theft of a song via a wide-scale distribution'on the hitemet is 
substantially reduced. - ^ - - - . , . . . 

. : r FIG- V'J'^*'^*^S:^ ^^3™P'c block di^ 

accordance \yith this invention, the protection system 1 00 comprises an encoder 1 1 0 that 
, enTOd^s content material onto a mediurh 130, and a decoder 120 that renders the content 
20 material fi-om the medium 130. The encoder 1 10 ihcludes a selector 1 12 that selects content 
., : . .„ ^^^^^} from a source SRC, a binder 116 that builds an entirety verification structure, and a 
recorder 1 14 that records the content material onto the medium 130. The selector 112, for 
!^ configured to select content material conesponding to songs that are being 
; , ' i ^.'"f? ^**':.^^.°?.^^5^'^"<^^V^5*' selected content material item is termed 

' ^tft^ ^ "data set". iEach data item comprises 

9"^ ^^ctions of data that form the data item, the totality of sections also forming the 

"data set^'. The binder 1 16 creates a data structure consisting of links between sections of the 
; ?f*^ 1^?"",^^? of which the entirety of the data set can be' verified. Preferably, each 
. i ^9^^^!^}^^ H ^^^!^ ^P -^h^ section via the use.of one or more wateimarks! the recorder 1 14 
M.. formats, encodes, and stores the data set, witfi the aforementioned data 

structure, on the medium 1 30, using techniques comrnon in Ae art 

In accordance with this invention, the selector 1 12 selects data items to be 
added to the data set until the size of the data set is deemed large enough to discourage a 
subsequent transmission of the data set via a limited bandwidth communications channel. 
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This "discouraging size'' is a subjective value, and will depend upon the assumed available 
conununications bandwidth, the loss incurred by the transmission, and so on. Other criteria 
may also be used to determine whether to add additional data items to the data set. For 
example, if the data items correspond to songs of an existing album collection, all of the 
5 songs will typically be added to the data set, regardless of whether the size of the data set has 
exceeded the determined discouraging size. If all of the songs of the album collection have 
been selected, and the discouraging size criterion has not yet been reached, other data items 
^ are selected to accumulate the required discouraging size. For example, data items 
comprising random data bits may be added to the data set to increase its size. These random 

10 bits will typically be stored as out of band data, CD-ROM data, and the like, to prevent it 
from being rendered as audible sounds by a conventional CD player. Alternatively, the data 
items may comprise other sample songs that are provided to encourage the sale of other 
albums, or images and video sections related to the recorded content materiai. Siniiiarly, 
promotional material, such as Internet access subscription programs may also be included in 

15 the recorded information on the recorded rnedium. These and other means of adding size to a 
data set will be evident to one of ordinary skill in the art in view of this inventioa 

The decoder 120 in accordance with this invention comprises a renderer 122 
and a gate 124 that is controlled by ari entirety checker 126. The renderer 122 is configured to 
retneve information fix)m a medium reading device, such as a CD reader 132. As is conmion 

20 in the art, the renderer 122 retrieves the information by specifying a location index, and in 
response, the reader 1 32 provides the data located at the specified location mdex on the 
medium 130. Block reads of data at contiguous locations on the medium 130 are effected by 
specifying a location index and a block size. 

The dotted lines of FIG. 1 illustrate an example song extractor 142 that 

25 extracts a song from the medium 1 30 and communicates it to an example CD imitator 144, 
representative of a possible iilicit download ot the song via the Internet. Tlie CD imitator 1 44 
represents, for example, a software program that provides information in response to a 
conventional CD-read conunand. Alternatively, the information received from the song 
extractor can be written to a CD mediurn, and provided to the conventioniai CD reader 1 32. 

30 As noted above, the song extractor 142 is likely to be used because the transmission of the 
entirety of the contents of the medium 1 30 is assumed to be discouraged by the puiposefully 
large size of the contents of the medium 1 30. 
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assigned to the linked-to section, as well as its link address aiid associiated random number. 
The random number associated with the linked-to section that is contained in the start section 
is compared with the random number contained in the linked-to section. If the random 
numbers iare not equal, subsequent processing of data items in the data set, such as the 
rendering of a song, is terminated. As noted al^ve, other iinked-identifier teclm may 
aiso be used, such as storing a random number in one section, and a function, such as a hash, 
of this number in the linked-to section. If an alternative encoding scheme is used, the 



^^J.. J;: 



comparison is modified accordingly. 

if the section-identifiers are found to be equivalent, the process continues, by 
10 advancing to the linked-to section. The above section-identifier matching is continued for 
each subsequent linked-to section, until sufficient confidence is gained that the entirety of the 
data set is present. In this embodiment, absolute confidence can be gained by continuing until 
the linked-to section becomes the original start section, indicating that all links in fhe closed 
linked list have been processed. The reaiding of each watenriark, however, is time consuming. 



15 and a substantial delay before the rendering of a song may be unacceptable to consumers^ In 
a preferred embodiment, the rendering of the song begins immediately after a few successfiil 
random number matches. Thereafter, if the rendering system is able to read information from 
the medium faster than is required for rendering the material, additional linked-to section 
watermarks are read and verified, and the rendering is ferminated if and when a mis-match is 

20" found.'"" " ' ' ^ ' - X . 

Other data structures and corresponding encoding and decoding processes will 
be evident to one of ordinary skill in the art in view of this invention. FIG. 4 illustrates an 
alternative data structure 600 that uses randomly linked pairs of sections to verify the 
presence of an entirety of tibe data set. In FIG. 4, each section 620 has an associated iinked-to 

25 section L 634 and an associated random number R 636. In this example alternative 

embodiment, the linked-to section 620' has a linked-to section L 634' that points back to the 
linked-from section 620, That is, the linked-to addresses L 634, 634' form a linked pair of 
sections 620, 620'. In this data structure, a common random nimiber R 636 is assigned to 
each section of the linked pair of sections 620, 620'. To determine whether an entirety of the 

30 data set is present, randomly selected sections are tested by verifying that each section's 
random number is equal to the random number at its finked-to section. It is assumed herein 

that the range, or approximate range, of the section addresses can be determined, so that the 

o^r :rf.-- ■•v'^ocr; ^y-PC r ..v; >^ j^-^ -i-^i. - j :;H:i:rKi^v^^; r-: v ^ i k. 

first "randomly selected section" is a viable section on the recorded medium. For example, 

the table of contents of the medium may be used to determine the viable track addresses, 
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^ 10 "'"-'^ ' ^ 

assuming that the table of contents has an embedded fragile Watermark, or other security 
device, that can be used to determine the validity of the table of contents. If a range cannot be 
de^termined, the first randomly selected section will be fronri the track selected for rendering. 
In this manner, if a nrialicious party uses a song extractor 142 (FIG. 1) to "rip" a song from a 

5 CD, and communicates it, in compressed or uncompressed form, via the Internet, a 

verification of the links will result in a "track-section not found" responise from the CD reader 
132 or CD imitator 144 for any link in the sections of the song that link-to a section of 
another song in the original data set. If the CD imitator 144 substitutes a bogus section in 
response to this verification request, the bogus section will not contain the appropriate 

10 random number watermark, and die entirety checker 126 will preclude further renderings of 
the ripped song. 

Regardless of whether the selected song is used to generate the first section for 
verification,, absolute certainty that all sections are present can be achieved by maintaining a 
list of tested sections, and verification continued until all section-pairs are tested. This 

1 5 approach assumes that the range of the section addresses can be determined or estimated, so 
that a truncation of the data set can be detected. In the case of the selected song being used to 
initiate the verification, the range of the section addresses can be assimied to be continuous 
through the range of link addresses in the selected song. For example, if one of the link 
addresses is track 10, section 9, a verification of each section 0 through 9 of track 10 can be 

20 made, and a verification of section 0 of tracks 0 through 1 6 can be made. These and other 

techniques for filling in a search area will be evident to one of ordinary skill in the art in view 
of this disclqsiire. 

In a preferrjed embodiment, to minimize the time required to effect the 
determination that the entirety of the data set is present, random section pairs are tested until 

25 sufficient confidence is gained to justify the determination, with substantial statistical 
certainty. That is, for example, if only half the data set is actually present, the random 
selection of the first section, from within the total range of all sections, is likely to detect an 
absence of this section 50% of the time; if this section is present, the likelihood of its linked- 
to section being present is 50%. Thus^ a successfiil pair-test provides 75% confidence that at 

30 least half the data set is present. Each successive test increases either the confidence level or 
the expected proportion of the data set being present, or both. Statistical tests are commonly 
available for determining an appropriate number of pair-test to achieve a desired level of 
confidence that a given proportion of the data set is present. In a typical embodiment, the 
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5. The method of claim 4, wherein creating the closed linked list includes a 

random iselectibn: >^ ; ; 



6. Th^ method of clairti i ; Wherem assigning the link addre^ (230) to each 

5 section includes / '-^ ^ ^ ^ ; 

selecting a random other section to link to the section via the link address 
(230). ■ uin-',.^,i: r-\/>:- ;v:/ r.{ 

7. The method of cllaim'l, fuiihdfincluding^^^ - ^ 

1 0 assignmg a verification parameter (332) to each section of the plurality of * 

sections (220), to facilitate a subsequent verificatioii thk eacti section corresponding to each 
Hnk address (230) is a valid secti ' ,v v. . 

8. The method of claim 7, further includmg: 

1 5 encoding the link address (230) of each section and the verification parameter 

(332) as one 6f more wiatermarks tiiat are embedded in the section. ^ 

9. The method of claim 8, wherein 

the one or more watermarks include: ' ^ 
20 a robust watennark that is^bii^ 

robust watermark causes a comiptibn of dali c6nt^rie(i in t^^ ^ectiori, arid ^ ' 

a fragile watermark that is configured such that a modification of the 
data contained in the section ciaiises a (iorniptioh of thfe fragile watermark. 

25 10. A method of decoding content material from a source comprising: ' 

reading one or more first entirety parameters (230, 332, 336) associated with a 
first section (220) of a data set, ^ - ^ . : a 

the one or more firet entirety jiaramete^s (230, 332, 336) comprising a 
link address (230) to a second section c)ftik;id^t^ ' ' - r ^ , ^ v -a 
30 reading one or more second entirety parameters (230, 332, 336) associated 

with the second section of the data set^anS" '^'^ -a 

decoding subsequent secf ions of tft clata set iri dependence upon the reading 
of the one or moi^e second entirety parameter (230^ 33!^, 336), 
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11. , pje method^ of claim 10, wher^^^ , . : , 

the one or more second entirety parameters (230, 332, 336) include a section 
verification parameter (332), and 

■ : . the decoding of the subs^equentsectio^^ 
5 verification parameter (332). 

12. The method of claim 1 1 , wherein ' 

the section verification parameter (332) comprises a random number that is 
associated with the second section when the data set is created. 
10; ,,: , ...^ ^ ^ - ,, : . . ^ _ y, 

13. TJiie ipethod of daim 10, 

reading subsequent entirety parameter;? (230, 332, 33,6) associated with other 
sections of the data set, based on the reading of the second entirety parameters (230, 332, 

336), ^■ ■ r X 

15 , . : ->yherein . . . r. . , . , , ..^ 

the debodiijjg of sut>sequent sections of the data set is in further dependence 
upon the reading of the subsequent entirety parameters (230, 332, 336). 

14. The method of claijrn. 13, fiirther incluA^ 

20 ^ : : ^ detemimng.when Uip reading of the ^ybsequent entirety parameters (230, 332, 

336) includes a copiplestion of reading of all sectipns of the data set. 

15. The method of claim 1 0, fiirther including 

rendering content material corresponding to the subsequent sections of the 

25 dataset,__. . „^.... ^ ^ . ... - ..^^ • ^ ■ 

16. The method of claim 1 0, wherein 

; the one or more second entirety p^ameters (230, 332, 336) are embedded in 



30 



the second section as one or more watermarks. . . .. 

17. The method of claim 16, wherein , , 

f. theoneor more wateraiarks. include: 

, a robust \yatermark that is configured such that a removal of the 
robust watermark causes a corruption of data contained in the second section, and 
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a fragile watermark that is configured such that a modification of the 
data contained in the second section causes a corruption of the fragile waterm^k. 



18. A storage medium (130) that is configured to contain content material, the 

storage medium (130) comprising ' ■ ' ; - r\y 

a data structure (200, 300) that includes: 
a plurality of sections (226)ran^ 

one or more entirety parameters (230, 332, 336) corresponding to 
each section ofthe plurality of sections (220), ' - ^ ; i 

wherein 

, the one or more entirety parameters (230, 332, 336) include a link address 
(l30) that links the corresponding section to an other section of the plurality of sections (220) 
. ^? f^!^^^^^^ whether an entirety sections (2^0) is present 

on a subsequent copy of at least a portion of thb plurality of sections (220). 



1 9. An encoder (110) comprismg: 

a selector (112) that is configured to select data items (2 1 0) comprisine a data 

set so that an accumulated size of the data set is sufficient to discourage a transmission ofthe 

data set via a limited bandwidth cbnmiuriications chacihel, " 

each data item of the data items (2 1 0) comprising one or more 
sections (220), ^ ^ .f. . - ^ . -'-■•^ ' ■ ^ - 

a binder (116) that is configured to as;sociate a link address (230) to each 
^tion Pf the data items (210) comprising the data seethe link address (230) corresponding 
to an odier seption qf the date items (210) comprising the date set, and 

a recorder (1 14) that is configured to record each section and each associated 
link address (230) to a medium (1 30) to facilitate a subsequent rendering oif the data items 
(210) in dependence upon a presence of one or more of the other sections ofthe data items 
(210) corresponding to the link address (230) of one or more sections (220) ofthe date set. 



20. The encoder (110) of claim 19, wherein 

the binder (1 1 6) is further configured tb*associate the linik address (230) to 
each section via a random process. 



21. 



The encoder (110) of claim 19, wherein 
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the binder (1 16) is further configured to associate a section verification 
parameter (332) to each section, and 

the recorder (1 14) is further configured to record the section verification 
, parameter (332) with each section to facilitate a verification that the section is present in the 
subsequent rendering of the data items (210). 

22. The encoder ( 1 1 0) of claim 1 9, wherein ' 
. the binder (1 16) associates the section verification parameter (332) to each 

section based on a random process. 

23. A decoder (120) comprising: 

a renderer (122) that is configured to receive datat items (21 0) corresjwnding to 
a data set, and to produce therefi'om a rendering corresponding to a select data item, . 

each data item, of the data items (2 1 0) including one or more sections 
1 5 (220), thereby forming a plurality of sections (220) comprising tfie data set, 

each section of the plurality of sections (220) including a link address 
(230) corresponding to an other section of the data set, and 

an entirety checker (126), operably coupled to the renderer (122), that is 
configured to preclude the rendering corresponding to the select data item in dependence 
20 upon a presence of one or more of the other sectidiis corresponding to the link address (230) 
of one or more sections (220) of the plurality of sections (220). 

24. The decoder (120) ofclaim 23, wherein 

the entirety checker (1 26) is further configured to determine the presence of all 
25 other sections corresponding to the link address (230) of all sections of the plurality of 
sections,(220). 

25. The decoder (120) ofclaim 23, wherein 

the entirety checker (1 26) is fxiither configured to verify the presence of the 
30 one or more other sections based on a verification parameter (332) that is associated with 
each section. 
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